Greetings from a new user. My apologies if this has already been addressed, but I didnt see anything in the archives and have been struggling to get things working right (and Im so close!). It looks like nfsen will do exactly what I want if only I can work this this problem that I am having:
Im running nfsen 1.3 on a Solaris 10 box. After a little bit of futzing to get it going (seems the conf.php file still starts with "<?" and not "<?php", BTW), everything seems to be working reasonably well with just the live profile. When I create any other profile that I have tried, the graphs stop updating and the "End" time in the "Profileinfo" freezes where it is until I remove the profile I created. The profile I create never gets anything to show on a graph and has the same start and end time in its "Profileinfo" listing. Reloading "live" seems to update the start and end times (but not the graphs of course), but the end time never increases beyond that until the new profile is removed. Throughout this time, nfcapd seems to keep working and adding to data files on the disk. Logs seem to be fairly normal with the exception being this exchange showing up with the added profile exists: Sep 8 23:40:15 anfmon <13>Sep 8 23:40:15 nfsen[5319]: Run periodic at Mon Sep 8 23:40:00 2008 Sep 8 23:40:15 anfmon <13>Sep 8 23:40:15 nfsen[5319]: Prepare profiling './live' Sep 8 23:40:15 anfmon <13>Sep 8 23:40:15 nfsen[5319]: Prepare profiling 'HiSeasNet/SatMex5b2' Sep 8 23:40:15 anfmon <12>Sep 8 23:40:15 nfsen[5319]: 2 channels/ alerts to profile Sep 8 23:40:15 anfmon <13>Sep 8 23:40:15 nfsen[5319]: profile opts: HiSeasNet#SatMex5b2#2#WaltonSmithOut#kuband Sep 8 23:40:15 anfmon <13>Sep 8 23:40:15 nfsen[5319]: profile opts: HiSeasNet#SatMex5b2#2#EndeavorOut#kuband Sep 8 23:40:15 anfmon <13>Sep 8 23:40:15 nfsen[5319]: nfsend: exit child[18392] Exit: 0, Signal: 9, Core: 0 Sep 8 23:40:15 anfmon <9>Sep 8 23:40:15 nfsen[5319]: nfprofile failed: Sep 8 23:40:15 anfmon <13>Sep 8 23:40:15 nfsen[5319]: System was: / opt/netflow/bin/nfprofile -I -t 1220916900 -p /opt/netflow/profiles- data -P /opt/netflow/profiles-stat -S 5 -M /opt/netflow/profiles-data/ live/kuband -r nfcapd.200809082335 Normally (with no profile) it looks something like: Sep 5 04:30:15 anfmon <13>Sep 5 04:30:15 nfsen[25768]: Run periodic at Fri Sep 5 04:30:00 2008 Sep 5 04:30:15 anfmon <13>Sep 5 04:30:15 nfsen[25768]: Prepare profiling './live' Sep 5 04:30:15 anfmon <12>Sep 5 04:30:15 nfsen[25768]: 0 channels/ alerts to profile Sep 5 04:30:15 anfmon <13>Sep 5 04:30:15 nfsen[25768]: No continous profiles - nothing to profile Sep 5 04:30:15 anfmon <12>Sep 5 04:30:15 nfsen[25768]: Update profile live in group . Sep 5 04:30:15 anfmon <13>Sep 5 04:30:15 nfsen[25768]: Add channel size 62583808 Sep 5 04:30:15 anfmon <13>Sep 5 04:30:15 nfsen[25768]: Set new profile size: 62583808 Sep 5 04:30:15 anfmon <13>Sep 5 04:30:15 nfsen[25768]: Add .:live: 200809050425 for plugin processing I saw a post about filters causing similar problems, but the channel filters (no filtering on the profile) I have tried are pretty straight forward and accepted by both nfdump on the command line, as well as nfsen in the Netflow Processing form. Specifically I have tried filters of "IN IF 4" and "( DST NET 131.128/16 ) and ( ( OUT IF 14 ) or ( OUT IF 23 ) )". I have also tried both real and shadow profiles that are continuous. Ultimately I am trying to graph individual network usage and top talkers across a couple of router interfaces that handles traffic to 5-10 networks in near real-time (5 min delay is okay, but Id rather have 1-2 min delay). Id love to see which network destinations are using what portion of the link. If there is a better way than filtering channels in a profile, Id love to hear it. Thanks for any suggestions, -Steve ----- Steve Foley Scripps Institution of Oceanography [EMAIL PROTECTED], (858) 822-3356 ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/ _______________________________________________ Nfsen-discuss mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
